1 /* SPDX-License-Identifier: LGPL-2.1+ */
10 #include "cpu-set-util.h"
12 #include "format-util.h"
14 #include "hostname-util.h"
16 #include "missing_sched.h"
17 #include "nspawn-oci.h"
18 #include "path-util.h"
19 #include "rlimit-util.h"
21 #include "seccomp-util.h"
23 #include "stat-util.h"
24 #include "stdio-util.h"
25 #include "string-util.h"
27 #include "user-util.h"
30 * OCI runtime tool implementation
35 * How is RLIM_INFINITY supposed to be encoded?
36 * configured effective caps is bullshit, as execv() corrupts it anyway
37 * pipes bind mounted is *very* different from pipes newly created, comments regarding bind mount or not are bogus
38 * annotation values structured? or string?
39 * configurable file system namespace path, but then also root path? wtf?
40 * apply sysctl inside of the container? or outside?
41 * how is unlimited pids tasks limit to be encoded?
42 * what are the defaults for caps if not specified?
43 * what are the default uid/gid mappings if one is missing but the other set, or when user ns is on but no namespace configured
44 * the source field of "mounts" is really weird, as it cannot realistically be relative to the bundle, since we never know if that's what the fs wants
45 * spec contradicts itself on the mount "type" field, as the example uses "bind" as type, but it's not listed in /proc/filesystem, and is something made up by /bin/mount
46 * if type of mount is left out, what shall be assumed? "bind"?
47 * readonly mounts is entirely redundant?
48 * should escaping be applied when joining mount options with ","?
49 * devices cgroup support is bogus, "allow" and "deny" on the kernel level is about adding/removing entries, not about access
50 * spec needs to say that "rwm" devices cgroup combination can't be the empty string
51 * cgrouspv1 crap: kernel, kernelTCP, swapiness, disableOOMKiller, swap, devices, leafWeight
52 * general: it shouldn't leak lower level abstractions this obviously
53 * unmanagable cgroups stuff: realtimeRuntime/realtimePeriod
54 * needs to say what happense when some option is not specified, i.e. which defaults apply
55 * no architecture? no personality?
56 * seccomp example and logic is simply broken: there's no constant "SCMP_ACT_ERRNO".
57 * spec should say what to do with unknown props
58 * /bin/mount regarding NFS and FUSE required?
59 * what does terminal=false mean?
60 * sysctl inside or outside? allow-listing?
61 * swapiness typo -> swappiness
66 * selinuxLabel + mountLabel
71 * swappiness, disableOOMKiller, kernel, kernelTCP, leafWeight (because it's dead, cgroupsv2 can't do it and hence systemd neither)
73 * Non-slice cgroup paths
74 * Propagation that is not slave + shared
75 * more than one uid/gid mapping, mappings with a container base != 0, or non-matching uid/gid mappings
76 * device cgroups access = false items that are not catchall
77 * device cgroups matches where minor is specified, but major isn't. similar where major is specified but char/block is not. also, any match that only has a type set that has less than "rwm" set. also, any entry that has none of rwm set.
81 static int oci_unexpected(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
82 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
83 "Unexpected OCI element '%s' of type '%s'.", name
, json_variant_type_to_string(json_variant_type(v
)));
86 static int oci_unsupported(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
87 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
88 "Unsupported OCI element '%s' of type '%s'.", name
, json_variant_type_to_string(json_variant_type(v
)));
91 static int oci_terminal(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
92 Settings
*s
= userdata
;
94 /* If not specified, or set to true, we'll default to either an interactive or a read-only
95 * console. If specified as false, we'll forcibly move to "pipe" mode though. */
96 s
->console_mode
= json_variant_boolean(v
) ? _CONSOLE_MODE_INVALID
: CONSOLE_PIPE
;
100 static int oci_console_dimension(const char *name
, JsonVariant
*variant
, JsonDispatchFlags flags
, void *userdata
) {
101 unsigned *u
= userdata
;
106 k
= json_variant_unsigned(variant
);
108 return json_log(variant
, flags
, SYNTHETIC_ERRNO(ERANGE
),
109 "Console size field '%s' is too small.", strna(name
));
110 if (k
> USHRT_MAX
) /* TIOCSWINSZ's struct winsize uses "unsigned short" for width and height */
111 return json_log(variant
, flags
, SYNTHETIC_ERRNO(ERANGE
),
112 "Console size field '%s' is too large.", strna(name
));
118 static int oci_console_size(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
120 static const JsonDispatch table
[] = {
121 { "height", JSON_VARIANT_UNSIGNED
, oci_console_dimension
, offsetof(Settings
, console_height
), JSON_MANDATORY
},
122 { "width", JSON_VARIANT_UNSIGNED
, oci_console_dimension
, offsetof(Settings
, console_width
), JSON_MANDATORY
},
126 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
129 static int oci_absolute_path(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
135 n
= json_variant_string(v
);
137 if (!path_is_absolute(n
))
138 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
139 "Path in JSON field '%s' is not absolute: %s", strna(name
), n
);
141 return free_and_strdup_warn(p
, n
);
144 static int oci_env(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
145 char ***l
= userdata
;
151 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
154 if (!json_variant_is_string(e
))
155 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
156 "Environment array contains non-string.");
158 assert_se(n
= json_variant_string(e
));
160 if (!env_assignment_is_valid(n
))
161 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
162 "Environment assignment not valid: %s", n
);
164 r
= strv_extend(l
, n
);
172 static int oci_args(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
173 _cleanup_strv_free_
char **l
= NULL
;
174 char ***value
= userdata
;
179 r
= json_variant_strv(v
, &l
);
181 return json_log(v
, flags
, r
, "Cannot parse arguments as list of strings: %m");
184 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
185 "Argument list empty, refusing.");
188 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
189 "Executable name is empty, refusing.");
191 return strv_free_and_replace(*value
, l
);
194 static int oci_rlimit_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
196 int t
, *type
= userdata
;
200 z
= startswith(json_variant_string(v
), "RLIMIT_");
202 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
203 "rlimit entry's name does not begin with 'RLIMIT_', refusing: %s",
204 json_variant_string(v
));
206 t
= rlimit_from_string(z
);
208 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
209 "rlimit name unknown: %s", json_variant_string(v
));
215 static int oci_rlimit_value(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
216 rlim_t z
, *value
= userdata
;
220 if (json_variant_is_negative(v
))
223 if (!json_variant_is_unsigned(v
))
224 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
225 "rlimits limit not unsigned, refusing.");
227 z
= (rlim_t
) json_variant_unsigned(v
);
229 if ((uintmax_t) z
!= json_variant_unsigned(v
))
230 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
231 "rlimits limit out of range, refusing.");
238 static int oci_rlimits(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
240 Settings
*s
= userdata
;
246 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
254 .soft
= RLIM_INFINITY
,
255 .hard
= RLIM_INFINITY
,
258 static const JsonDispatch table
[] = {
259 { "soft", JSON_VARIANT_NUMBER
, oci_rlimit_value
, offsetof(struct rlimit_data
, soft
), JSON_MANDATORY
},
260 { "hard", JSON_VARIANT_NUMBER
, oci_rlimit_value
, offsetof(struct rlimit_data
, hard
), JSON_MANDATORY
},
261 { "type", JSON_VARIANT_STRING
, oci_rlimit_type
, offsetof(struct rlimit_data
, type
), JSON_MANDATORY
},
265 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
269 assert(data
.type
>= 0);
270 assert(data
.type
< _RLIMIT_MAX
);
272 if (s
->rlimit
[data
.type
])
273 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
274 "rlimits array contains duplicate entry, refusing.");
276 s
->rlimit
[data
.type
] = new(struct rlimit
, 1);
277 if (!s
->rlimit
[data
.type
])
280 *s
->rlimit
[data
.type
] = (struct rlimit
) {
281 .rlim_cur
= data
.soft
,
282 .rlim_max
= data
.hard
,
289 static int oci_capability_array(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
290 uint64_t *mask
= userdata
, m
= 0;
293 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
297 if (!json_variant_is_string(e
))
298 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
299 "Entry in capabilities array is not a string.");
301 assert_se(n
= json_variant_string(e
));
303 cap
= capability_from_name(n
);
305 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
306 "Unknown capability: %s", n
);
308 m
|= UINT64_C(1) << cap
;
311 if (*mask
== (uint64_t) -1)
319 static int oci_capabilities(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
321 static const JsonDispatch table
[] = {
322 { "effective", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, effective
) },
323 { "bounding", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, bounding
) },
324 { "inheritable", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, inheritable
) },
325 { "permitted", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, permitted
) },
326 { "ambient", JSON_VARIANT_ARRAY
, oci_capability_array
, offsetof(CapabilityQuintet
, ambient
) },
330 Settings
*s
= userdata
;
335 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &s
->full_capabilities
);
339 if (s
->full_capabilities
.bounding
!= (uint64_t) -1) {
340 s
->capability
= s
->full_capabilities
.bounding
;
341 s
->drop_capability
= ~s
->full_capabilities
.bounding
;
347 static int oci_oom_score_adj(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
348 Settings
*s
= userdata
;
353 k
= json_variant_integer(v
);
354 if (k
< OOM_SCORE_ADJ_MIN
|| k
> OOM_SCORE_ADJ_MAX
)
355 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
356 "oomScoreAdj value out of range: %ji", k
);
358 s
->oom_score_adjust
= (int) k
;
359 s
->oom_score_adjust_set
= true;
364 static int oci_uid_gid(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
365 uid_t
*uid
= userdata
, u
;
369 assert_cc(sizeof(uid_t
) == sizeof(gid_t
));
371 k
= json_variant_unsigned(v
);
373 if ((uintmax_t) u
!= k
)
374 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
375 "UID/GID out of range: %ji", k
);
377 if (!uid_is_valid(u
))
378 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
379 "UID/GID is not valid: " UID_FMT
, u
);
385 static int oci_supplementary_gids(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
386 Settings
*s
= userdata
;
392 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
395 if (!json_variant_is_unsigned(e
))
396 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
397 "Supplementary GID entry is not a UID.");
399 r
= oci_uid_gid(name
, e
, flags
, &gid
);
403 a
= reallocarray(s
->supplementary_gids
, s
->n_supplementary_gids
+ 1, sizeof(gid_t
));
407 s
->supplementary_gids
= a
;
408 s
->supplementary_gids
[s
->n_supplementary_gids
++] = gid
;
414 static int oci_user(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
415 static const JsonDispatch table
[] = {
416 { "uid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(Settings
, uid
), JSON_MANDATORY
},
417 { "gid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(Settings
, gid
), JSON_MANDATORY
},
418 { "additionalGids", JSON_VARIANT_ARRAY
, oci_supplementary_gids
, 0, 0 },
422 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
425 static int oci_process(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
427 static const JsonDispatch table
[] = {
428 { "terminal", JSON_VARIANT_BOOLEAN
, oci_terminal
, 0, 0 },
429 { "consoleSize", JSON_VARIANT_OBJECT
, oci_console_size
, 0, 0 },
430 { "cwd", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(Settings
, working_directory
), 0 },
431 { "env", JSON_VARIANT_ARRAY
, oci_env
, offsetof(Settings
, environment
), 0 },
432 { "args", JSON_VARIANT_ARRAY
, oci_args
, offsetof(Settings
, parameters
), 0 },
433 { "rlimits", JSON_VARIANT_ARRAY
, oci_rlimits
, 0, 0 },
434 { "apparmorProfile", JSON_VARIANT_STRING
, oci_unsupported
, 0, JSON_PERMISSIVE
},
435 { "capabilities", JSON_VARIANT_OBJECT
, oci_capabilities
, 0, 0 },
436 { "noNewPrivileges", JSON_VARIANT_BOOLEAN
, json_dispatch_boolean
, offsetof(Settings
, no_new_privileges
), 0 },
437 { "oomScoreAdj", JSON_VARIANT_INTEGER
, oci_oom_score_adj
, 0, 0 },
438 { "selinuxLabel", JSON_VARIANT_STRING
, oci_unsupported
, 0, JSON_PERMISSIVE
},
439 { "user", JSON_VARIANT_OBJECT
, oci_user
, 0, 0 },
443 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
446 static int oci_root(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
448 static const JsonDispatch table
[] = {
449 { "path", JSON_VARIANT_STRING
, json_dispatch_string
, offsetof(Settings
, root
) },
450 { "readonly", JSON_VARIANT_BOOLEAN
, json_dispatch_boolean
, offsetof(Settings
, read_only
) },
454 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
457 static int oci_hostname(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
458 Settings
*s
= userdata
;
463 assert_se(n
= json_variant_string(v
));
465 if (!hostname_is_valid(n
, false))
466 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
467 "Hostname string is not a valid hostname: %s", n
);
469 return free_and_strdup_warn(&s
->hostname
, n
);
472 static bool oci_exclude_mount(const char *path
) {
474 /* Returns "true" for all mounts we insist to mount on our own, and hence ignore the OCI data. */
476 if (PATH_IN_SET(path
,
494 "/proc/sysrq-trigger",
503 /* Similar, skip the whole /sys/fs/cgroups subtree */
504 if (path_startswith(path
, "/sys/fs/cgroup"))
510 typedef struct oci_mount_data
{
517 static void cleanup_oci_mount_data(oci_mount_data
*data
) {
518 free(data
->destination
);
520 strv_free(data
->options
);
524 static int oci_mounts(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
525 Settings
*s
= userdata
;
531 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
532 static const JsonDispatch table
[] = {
533 { "destination", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(oci_mount_data
, destination
), JSON_MANDATORY
},
534 { "source", JSON_VARIANT_STRING
, json_dispatch_string
, offsetof(oci_mount_data
, source
), 0 },
535 { "options", JSON_VARIANT_ARRAY
, json_dispatch_strv
, offsetof(oci_mount_data
, options
), 0, },
536 { "type", JSON_VARIANT_STRING
, json_dispatch_string
, offsetof(oci_mount_data
, type
), 0 },
540 _cleanup_free_
char *joined_options
= NULL
;
542 _cleanup_(cleanup_oci_mount_data
) oci_mount_data data
= {};
544 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
548 if (!path_is_absolute(data
.destination
))
549 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
550 "Mount destination not an absolute path: %s", data
.destination
);
552 if (oci_exclude_mount(data
.destination
))
556 joined_options
= strv_join(data
.options
, ",");
561 if (!data
.type
|| streq(data
.type
, "bind")) {
562 if (data
.source
&& !path_is_absolute(data
.source
)) {
565 joined
= path_join(s
->bundle
, data
.source
);
569 free_and_replace(data
.source
, joined
);
572 data
.type
= mfree(data
.type
);
574 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_BIND
);
576 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_ARBITRARY
);
580 m
->destination
= TAKE_PTR(data
.destination
);
581 m
->source
= TAKE_PTR(data
.source
);
582 m
->options
= TAKE_PTR(joined_options
);
583 m
->type_argument
= TAKE_PTR(data
.type
);
589 static int oci_namespace_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
590 unsigned long *nsflags
= userdata
;
594 assert_se(n
= json_variant_string(v
));
596 /* We don't use namespace_flags_from_string() here, as the OCI spec uses slightly different names than the
599 *nsflags
= CLONE_NEWPID
;
600 else if (streq(n
, "network"))
601 *nsflags
= CLONE_NEWNET
;
602 else if (streq(n
, "mount"))
603 *nsflags
= CLONE_NEWNS
;
604 else if (streq(n
, "ipc"))
605 *nsflags
= CLONE_NEWIPC
;
606 else if (streq(n
, "uts"))
607 *nsflags
= CLONE_NEWUTS
;
608 else if (streq(n
, "user"))
609 *nsflags
= CLONE_NEWUSER
;
610 else if (streq(n
, "cgroup"))
611 *nsflags
= CLONE_NEWCGROUP
;
613 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
614 "Unknown cgroup type, refusing: %s", n
);
619 static int oci_namespaces(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
620 Settings
*s
= userdata
;
627 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
629 struct namespace_data
{
634 static const JsonDispatch table
[] = {
635 { "type", JSON_VARIANT_STRING
, oci_namespace_type
, offsetof(struct namespace_data
, type
), JSON_MANDATORY
},
636 { "path", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(struct namespace_data
, path
), 0 },
640 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
647 if (data
.type
!= CLONE_NEWNET
) {
649 return json_log(e
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
650 "Specifying namespace path for non-network namespace is not supported.");
653 if (s
->network_namespace_path
) {
655 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
656 "Network namespace path specified more than once, refusing.");
659 free(s
->network_namespace_path
);
660 s
->network_namespace_path
= data
.path
;
663 if (FLAGS_SET(n
, data
.type
)) {
664 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
665 "Duplicate namespace specification, refusing.");
671 if (!FLAGS_SET(n
, CLONE_NEWNS
))
672 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
673 "Containers without file system namespace aren't supported.");
675 s
->private_network
= FLAGS_SET(n
, CLONE_NEWNET
);
676 s
->userns_mode
= FLAGS_SET(n
, CLONE_NEWUSER
) ? USER_NAMESPACE_FIXED
: USER_NAMESPACE_NO
;
677 s
->use_cgns
= FLAGS_SET(n
, CLONE_NEWCGROUP
);
679 s
->clone_ns_flags
= n
& (CLONE_NEWIPC
|CLONE_NEWPID
|CLONE_NEWUTS
);
684 static int oci_uid_gid_range(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
685 uid_t
*uid
= userdata
, u
;
689 assert_cc(sizeof(uid_t
) == sizeof(gid_t
));
691 /* This is very much like oci_uid_gid(), except the checks are a bit different, as this is a UID range rather
692 * than a specific UID, and hence (uid_t) -1 has no special significance. OTOH a range of zero makes no
695 k
= json_variant_unsigned(v
);
697 if ((uintmax_t) u
!= k
)
698 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
699 "UID/GID out of range: %ji", k
);
701 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
702 "UID/GID range can't be zero.");
708 static int oci_uid_gid_mappings(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
709 struct mapping_data
{
714 .host_id
= UID_INVALID
,
715 .container_id
= UID_INVALID
,
719 static const JsonDispatch table
[] = {
720 { "containerID", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(struct mapping_data
, container_id
), JSON_MANDATORY
},
721 { "hostID", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(struct mapping_data
, host_id
), JSON_MANDATORY
},
722 { "size", JSON_VARIANT_UNSIGNED
, oci_uid_gid_range
, offsetof(struct mapping_data
, range
), JSON_MANDATORY
},
726 Settings
*s
= userdata
;
732 if (json_variant_elements(v
) == 0)
735 if (json_variant_elements(v
) > 1)
736 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
737 "UID/GID mappings with more than one entry are not supported.");
739 assert_se(e
= json_variant_by_index(v
, 0));
741 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
745 if (data
.host_id
+ data
.range
< data
.host_id
||
746 data
.container_id
+ data
.range
< data
.container_id
)
747 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
748 "UID/GID range goes beyond UID/GID validity range, refusing.");
750 if (data
.container_id
!= 0)
751 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
752 "UID/GID mappings with a non-zero container base are not supported.");
754 if (data
.range
< 0x10000)
755 json_log(v
, flags
|JSON_WARNING
, 0,
756 "UID/GID mapping with less than 65536 UID/GIDS set up, you are looking for trouble.");
758 if (s
->uid_range
!= UID_INVALID
&&
759 (s
->uid_shift
!= data
.host_id
|| s
->uid_range
!= data
.range
))
760 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
761 "Non-matching UID and GID mappings are not supported.");
763 s
->uid_shift
= data
.host_id
;
764 s
->uid_range
= data
.range
;
769 static int oci_device_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
770 mode_t
*mode
= userdata
;
774 assert_se(t
= json_variant_string(v
));
776 if (STR_IN_SET(t
, "c", "u"))
777 *mode
= (*mode
& ~S_IFMT
) | S_IFCHR
;
778 else if (streq(t
, "b"))
779 *mode
= (*mode
& ~S_IFMT
) | S_IFBLK
;
780 else if (streq(t
, "p"))
781 *mode
= (*mode
& ~S_IFMT
) | S_IFIFO
;
783 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
784 "Unknown device type: %s", t
);
789 static int oci_device_major(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
790 unsigned *u
= userdata
;
795 k
= json_variant_unsigned(v
);
796 if (!DEVICE_MAJOR_VALID(k
))
797 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
798 "Device major %ji out of range.", k
);
804 static int oci_device_minor(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
805 unsigned *u
= userdata
;
810 k
= json_variant_unsigned(v
);
811 if (!DEVICE_MINOR_VALID(k
))
812 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
813 "Device minor %ji out of range.", k
);
819 static int oci_device_file_mode(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
820 mode_t
*mode
= userdata
, m
;
825 k
= json_variant_unsigned(v
);
828 if ((m
& ~07777) != 0 || (uintmax_t) m
!= k
)
829 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
830 "fileMode out of range, refusing.");
836 static int oci_devices(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
837 Settings
*s
= userdata
;
843 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
845 static const JsonDispatch table
[] = {
846 { "type", JSON_VARIANT_STRING
, oci_device_type
, offsetof(DeviceNode
, mode
), JSON_MANDATORY
},
847 { "path", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(DeviceNode
, path
), JSON_MANDATORY
},
848 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(DeviceNode
, major
), 0 },
849 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(DeviceNode
, minor
), 0 },
850 { "fileMode", JSON_VARIANT_UNSIGNED
, oci_device_file_mode
, offsetof(DeviceNode
, mode
), 0 },
851 { "uid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(DeviceNode
, uid
), 0 },
852 { "gid", JSON_VARIANT_UNSIGNED
, oci_uid_gid
, offsetof(DeviceNode
, gid
), 0 },
856 DeviceNode
*node
, *nodes
;
858 nodes
= reallocarray(s
->extra_nodes
, s
->n_extra_nodes
+ 1, sizeof(DeviceNode
));
862 s
->extra_nodes
= nodes
;
864 node
= nodes
+ s
->n_extra_nodes
;
865 *node
= (DeviceNode
) {
868 .major
= (unsigned) -1,
869 .minor
= (unsigned) -1,
873 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, node
);
877 if (S_ISCHR(node
->mode
) || S_ISBLK(node
->mode
)) {
878 _cleanup_free_
char *path
= NULL
;
880 if (node
->major
== (unsigned) -1 || node
->minor
== (unsigned) -1) {
881 r
= json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
882 "Major/minor required when device node is device node");
886 /* Suppress a couple of implicit device nodes */
887 r
= device_path_make_canonical(node
->mode
, makedev(node
->major
, node
->minor
), &path
);
889 json_log(e
, flags
|JSON_DEBUG
, 0, "Failed to resolve device node %u:%u, ignoring: %m", node
->major
, node
->minor
);
891 if (PATH_IN_SET(path
,
903 json_log(e
, flags
|JSON_DEBUG
, 0, "Ignoring devices item for device '%s', as it is implicitly created anyway.", path
);
921 static int oci_cgroups_path(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
922 _cleanup_free_
char *slice
= NULL
, *backwards
= NULL
;
923 Settings
*s
= userdata
;
929 assert_se(p
= json_variant_string(v
));
931 r
= cg_path_get_slice(p
, &slice
);
933 return json_log(v
, flags
, r
, "Couldn't derive slice unit name from path '%s': %m", p
);
935 r
= cg_slice_to_path(slice
, &backwards
);
937 return json_log(v
, flags
, r
, "Couldn't convert slice unit name '%s' back to path: %m", slice
);
939 if (!path_equal(backwards
, p
))
940 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
941 "Control group path '%s' does not refer to slice unit, refusing.", p
);
943 free_and_replace(s
->slice
, slice
);
947 static int oci_cgroup_device_type(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
948 mode_t
*mode
= userdata
;
951 assert_se(n
= json_variant_string(v
));
955 else if (streq(n
, "b"))
958 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
959 "Control group device type unknown: %s", n
);
974 static int oci_cgroup_device_access(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
975 struct device_data
*d
= userdata
;
976 bool r
= false, w
= false, m
= false;
980 assert_se(s
= json_variant_string(v
));
982 for (i
= 0; s
[i
]; i
++)
985 else if (s
[i
] == 'w')
987 else if (s
[i
] == 'm')
990 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
991 "Unknown device access character '%c'.", s
[i
]);
1000 static int oci_cgroup_devices(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1002 _cleanup_free_
struct device_data
*list
= NULL
;
1003 Settings
*s
= userdata
;
1004 size_t n_list
= 0, i
;
1011 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1013 struct device_data data
= {
1014 .major
= (unsigned) -1,
1015 .minor
= (unsigned) -1,
1018 static const JsonDispatch table
[] = {
1019 { "allow", JSON_VARIANT_BOOLEAN
, json_dispatch_boolean
, offsetof(struct device_data
, allow
), JSON_MANDATORY
},
1020 { "type", JSON_VARIANT_STRING
, oci_cgroup_device_type
, offsetof(struct device_data
, type
), 0 },
1021 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(struct device_data
, major
), 0 },
1022 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(struct device_data
, minor
), 0 },
1023 { "access", JSON_VARIANT_STRING
, oci_cgroup_device_access
, 0, 0 },
1027 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
1032 /* The fact that OCI allows 'deny' entries makes really no sense, as 'allow'
1033 * vs. 'deny' for the devices cgroup controller is really not about allow-listing and
1034 * deny-listing but about adding and removing entries from the allow list. Since we
1035 * always start out with an empty allow list we hence ignore the whole thing, as
1036 * removing entries which don't exist make no sense. We'll log about this, since this
1037 * is really borked in the spec, with one exception: the entry that's supposed to
1038 * drop the kernel's default we ignore silently */
1040 if (!data
.r
|| !data
.w
|| !data
.m
|| data
.type
!= 0 || data
.major
!= (unsigned) -1 || data
.minor
!= (unsigned) -1)
1041 json_log(v
, flags
|JSON_WARNING
, 0, "Devices cgroup allow list with arbitrary 'allow' entries not supported, ignoring.");
1043 /* We ignore the 'deny' entry as for us that's implied */
1047 if (!data
.r
&& !data
.w
&& !data
.m
) {
1048 json_log(v
, flags
|LOG_WARNING
, 0, "Device cgroup allow list entry with no effect found, ignoring.");
1052 if (data
.minor
!= (unsigned) -1 && data
.major
== (unsigned) -1)
1053 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
1054 "Device cgroup allow list entries with minors but no majors not supported.");
1056 if (data
.major
!= (unsigned) -1 && data
.type
== 0)
1057 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
1058 "Device cgroup allow list entries with majors but no device node type not supported.");
1060 if (data
.type
== 0) {
1061 if (data
.r
&& data
.w
&& data
.m
) /* a catchall allow list entry means we are looking at a noop */
1064 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
),
1065 "Device cgroup allow list entries with no type not supported.");
1068 a
= reallocarray(list
, n_list
+ 1, sizeof(struct device_data
));
1073 list
[n_list
++] = data
;
1079 r
= settings_allocate_properties(s
);
1083 r
= sd_bus_message_open_container(s
->properties
, 'r', "sv");
1085 return bus_log_create_error(r
);
1087 r
= sd_bus_message_append(s
->properties
, "s", "DeviceAllow");
1089 return bus_log_create_error(r
);
1091 r
= sd_bus_message_open_container(s
->properties
, 'v', "a(ss)");
1093 return bus_log_create_error(r
);
1095 r
= sd_bus_message_open_container(s
->properties
, 'a', "(ss)");
1097 return bus_log_create_error(r
);
1099 for (i
= 0; i
< n_list
; i
++) {
1100 _cleanup_free_
char *pattern
= NULL
;
1104 if (list
[i
].minor
== (unsigned) -1) {
1107 if (list
[i
].type
== S_IFBLK
)
1110 assert(list
[i
].type
== S_IFCHR
);
1114 if (list
[i
].major
== (unsigned) -1) {
1115 pattern
= strjoin(t
, "-*");
1119 if (asprintf(&pattern
, "%s-%u", t
, list
[i
].major
) < 0)
1124 assert(list
[i
].major
!= (unsigned) -1); /* If a minor is specified, then a major also needs to be specified */
1126 r
= device_path_make_major_minor(list
[i
].type
, makedev(list
[i
].major
, list
[i
].minor
), &pattern
);
1141 r
= sd_bus_message_append(s
->properties
, "(ss)", pattern
, access
);
1143 return bus_log_create_error(r
);
1146 r
= sd_bus_message_close_container(s
->properties
);
1148 return bus_log_create_error(r
);
1150 r
= sd_bus_message_close_container(s
->properties
);
1152 return bus_log_create_error(r
);
1154 r
= sd_bus_message_close_container(s
->properties
);
1156 return bus_log_create_error(r
);
1161 static int oci_cgroup_memory_limit(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1162 uint64_t *m
= userdata
;
1167 if (json_variant_is_negative(v
)) {
1172 if (!json_variant_is_unsigned(v
))
1173 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1174 "Memory limit is not an unsigned integer");
1176 k
= json_variant_unsigned(v
);
1177 if (k
>= UINT64_MAX
)
1178 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1179 "Memory limit too large: %ji", k
);
1185 static int oci_cgroup_memory(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1187 struct memory_data
{
1189 uint64_t reservation
;
1192 .limit
= UINT64_MAX
,
1193 .reservation
= UINT64_MAX
,
1197 static const JsonDispatch table
[] = {
1198 { "limit", JSON_VARIANT_NUMBER
, oci_cgroup_memory_limit
, offsetof(struct memory_data
, limit
), 0 },
1199 { "reservation", JSON_VARIANT_NUMBER
, oci_cgroup_memory_limit
, offsetof(struct memory_data
, reservation
), 0 },
1200 { "swap", JSON_VARIANT_NUMBER
, oci_cgroup_memory_limit
, offsetof(struct memory_data
, swap
), 0 },
1201 { "kernel", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1202 { "kernelTCP", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1203 { "swapiness", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1204 { "disableOOMKiller", JSON_VARIANT_NUMBER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1208 Settings
*s
= userdata
;
1211 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &data
);
1215 if (data
.swap
!= UINT64_MAX
) {
1216 if (data
.limit
== UINT64_MAX
)
1217 json_log(v
, flags
|LOG_WARNING
, 0, "swap limit without memory limit is not supported, ignoring.");
1218 else if (data
.swap
< data
.limit
)
1219 json_log(v
, flags
|LOG_WARNING
, 0, "swap limit is below memory limit, ignoring.");
1221 r
= settings_allocate_properties(s
);
1225 r
= sd_bus_message_append(s
->properties
, "(sv)", "MemorySwapMax", "t", data
.swap
- data
.limit
);
1227 return bus_log_create_error(r
);
1231 if (data
.limit
!= UINT64_MAX
) {
1232 r
= settings_allocate_properties(s
);
1236 r
= sd_bus_message_append(s
->properties
, "(sv)", "MemoryMax", "t", data
.limit
);
1238 return bus_log_create_error(r
);
1241 if (data
.reservation
!= UINT64_MAX
) {
1242 r
= settings_allocate_properties(s
);
1246 r
= sd_bus_message_append(s
->properties
, "(sv)", "MemoryLow", "t", data
.reservation
);
1248 return bus_log_create_error(r
);
1261 static int oci_cgroup_cpu_shares(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1262 uint64_t *u
= userdata
;
1267 k
= json_variant_unsigned(v
);
1268 if (k
< CGROUP_CPU_SHARES_MIN
|| k
> CGROUP_CPU_SHARES_MAX
)
1269 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1270 "shares value out of range.");
1276 static int oci_cgroup_cpu_quota(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1277 uint64_t *u
= userdata
;
1282 k
= json_variant_unsigned(v
);
1283 if (k
<= 0 || k
>= UINT64_MAX
)
1284 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1285 "period/quota value out of range.");
1291 static int oci_cgroup_cpu_cpus(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1292 struct cpu_data
*data
= userdata
;
1299 assert_se(n
= json_variant_string(v
));
1301 r
= parse_cpu_set(n
, &set
);
1303 return json_log(v
, flags
, r
, "Failed to parse CPU set specification: %s", n
);
1305 cpu_set_reset(&data
->cpu_set
);
1306 data
->cpu_set
= set
;
1311 static int oci_cgroup_cpu(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1313 static const JsonDispatch table
[] = {
1314 { "shares", JSON_VARIANT_UNSIGNED
, oci_cgroup_cpu_shares
, offsetof(struct cpu_data
, shares
), 0 },
1315 { "quota", JSON_VARIANT_UNSIGNED
, oci_cgroup_cpu_quota
, offsetof(struct cpu_data
, quota
), 0 },
1316 { "period", JSON_VARIANT_UNSIGNED
, oci_cgroup_cpu_quota
, offsetof(struct cpu_data
, period
), 0 },
1317 { "realtimeRuntime", JSON_VARIANT_UNSIGNED
, oci_unsupported
, 0, 0 },
1318 { "realtimePeriod", JSON_VARIANT_UNSIGNED
, oci_unsupported
, 0, 0 },
1319 { "cpus", JSON_VARIANT_STRING
, oci_cgroup_cpu_cpus
, 0, 0 },
1320 { "mems", JSON_VARIANT_STRING
, oci_unsupported
, 0, 0 },
1324 struct cpu_data data
= {
1325 .shares
= UINT64_MAX
,
1326 .quota
= UINT64_MAX
,
1327 .period
= UINT64_MAX
,
1330 Settings
*s
= userdata
;
1333 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &data
);
1335 cpu_set_reset(&data
.cpu_set
);
1339 cpu_set_reset(&s
->cpu_set
);
1340 s
->cpu_set
= data
.cpu_set
;
1342 if (data
.shares
!= UINT64_MAX
) {
1343 r
= settings_allocate_properties(s
);
1347 r
= sd_bus_message_append(s
->properties
, "(sv)", "CPUShares", "t", data
.shares
);
1349 return bus_log_create_error(r
);
1352 if (data
.quota
!= UINT64_MAX
&& data
.period
!= UINT64_MAX
) {
1353 r
= settings_allocate_properties(s
);
1357 r
= sd_bus_message_append(s
->properties
, "(sv)", "CPUQuotaPerSecUSec", "t", (uint64_t) (data
.quota
* USEC_PER_SEC
/ data
.period
));
1359 return bus_log_create_error(r
);
1361 } else if ((data
.quota
!= UINT64_MAX
) != (data
.period
!= UINT64_MAX
))
1362 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1363 "CPU quota and period not used together.");
1368 static int oci_cgroup_block_io_weight(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1369 Settings
*s
= userdata
;
1375 k
= json_variant_unsigned(v
);
1376 if (k
< CGROUP_BLKIO_WEIGHT_MIN
|| k
> CGROUP_BLKIO_WEIGHT_MAX
)
1377 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1378 "Block I/O weight out of range.");
1380 r
= settings_allocate_properties(s
);
1384 r
= sd_bus_message_append(s
->properties
, "(sv)", "BlockIOWeight", "t", (uint64_t) k
);
1386 return bus_log_create_error(r
);
1391 static int oci_cgroup_block_io_weight_device(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1392 Settings
*s
= userdata
;
1398 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1399 struct device_data
{
1404 .major
= (unsigned) -1,
1405 .minor
= (unsigned) -1,
1406 .weight
= UINTMAX_MAX
,
1409 static const JsonDispatch table
[] = {
1410 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(struct device_data
, major
), JSON_MANDATORY
},
1411 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(struct device_data
, minor
), JSON_MANDATORY
},
1412 { "weight", JSON_VARIANT_UNSIGNED
, json_dispatch_unsigned
, offsetof(struct device_data
, weight
), 0 },
1413 { "leafWeight", JSON_VARIANT_INTEGER
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1417 _cleanup_free_
char *path
= NULL
;
1419 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
1423 if (data
.weight
== UINTMAX_MAX
)
1426 if (data
.weight
< CGROUP_BLKIO_WEIGHT_MIN
|| data
.weight
> CGROUP_BLKIO_WEIGHT_MAX
)
1427 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1428 "Block I/O device weight out of range.");
1430 r
= device_path_make_major_minor(S_IFBLK
, makedev(data
.major
, data
.minor
), &path
);
1432 return json_log(v
, flags
, r
, "Failed to build device path: %m");
1434 r
= settings_allocate_properties(s
);
1438 r
= sd_bus_message_append(s
->properties
, "(sv)", "BlockIODeviceWeight", "a(st)", 1, path
, (uint64_t) data
.weight
);
1440 return bus_log_create_error(r
);
1446 static int oci_cgroup_block_io_throttle(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1447 Settings
*s
= userdata
;
1454 pname
= streq(name
, "throttleReadBpsDevice") ? "IOReadBandwidthMax" :
1455 streq(name
, "throttleWriteBpsDevice") ? "IOWriteBandwidthMax" :
1456 streq(name
, "throttleReadIOPSDevice") ? "IOReadIOPSMax" :
1459 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1460 struct device_data
{
1465 .major
= (unsigned) -1,
1466 .minor
= (unsigned) -1,
1469 static const JsonDispatch table
[] = {
1470 { "major", JSON_VARIANT_UNSIGNED
, oci_device_major
, offsetof(struct device_data
, major
), JSON_MANDATORY
},
1471 { "minor", JSON_VARIANT_UNSIGNED
, oci_device_minor
, offsetof(struct device_data
, minor
), JSON_MANDATORY
},
1472 { "rate", JSON_VARIANT_UNSIGNED
, json_dispatch_unsigned
, offsetof(struct device_data
, rate
), JSON_MANDATORY
},
1476 _cleanup_free_
char *path
= NULL
;
1478 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &data
);
1482 if (data
.rate
>= UINT64_MAX
)
1483 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
1484 "Block I/O device rate out of range.");
1486 r
= device_path_make_major_minor(S_IFBLK
, makedev(data
.major
, data
.minor
), &path
);
1488 return json_log(v
, flags
, r
, "Failed to build device path: %m");
1490 r
= settings_allocate_properties(s
);
1494 r
= sd_bus_message_append(s
->properties
, "(sv)", pname
, "a(st)", 1, path
, (uint64_t) data
.rate
);
1496 return bus_log_create_error(r
);
1502 static int oci_cgroup_block_io(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1504 static const JsonDispatch table
[] = {
1505 { "weight", JSON_VARIANT_UNSIGNED
, oci_cgroup_block_io_weight
, 0, 0 },
1506 { "leafWeight", JSON_VARIANT_UNSIGNED
, oci_unsupported
, 0, JSON_PERMISSIVE
},
1507 { "weightDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_weight_device
, 0, 0 },
1508 { "throttleReadBpsDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1509 { "throttleWriteBpsDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1510 { "throttleReadIOPSDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1511 { "throttleWriteIOPSDevice", JSON_VARIANT_ARRAY
, oci_cgroup_block_io_throttle
, 0, 0 },
1515 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
1518 static int oci_cgroup_pids(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1520 static const JsonDispatch table
[] = {
1521 { "limit", JSON_VARIANT_NUMBER
, json_dispatch_variant
, 0, JSON_MANDATORY
},
1525 _cleanup_(json_variant_unrefp
) JsonVariant
*k
= NULL
;
1526 Settings
*s
= userdata
;
1532 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, &k
);
1536 if (json_variant_is_negative(k
))
1539 if (!json_variant_is_unsigned(k
))
1540 return json_log(k
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1541 "pids limit not unsigned integer, refusing.");
1543 m
= (uint64_t) json_variant_unsigned(k
);
1545 if ((uintmax_t) m
!= json_variant_unsigned(k
))
1546 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1547 "pids limit out of range, refusing.");
1550 r
= settings_allocate_properties(s
);
1554 r
= sd_bus_message_append(s
->properties
, "(sv)", "TasksMax", "t", m
);
1556 return bus_log_create_error(r
);
1561 static int oci_resources(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1563 static const JsonDispatch table
[] = {
1564 { "devices", JSON_VARIANT_ARRAY
, oci_cgroup_devices
, 0, 0 },
1565 { "memory", JSON_VARIANT_OBJECT
, oci_cgroup_memory
, 0, 0 },
1566 { "cpu", JSON_VARIANT_OBJECT
, oci_cgroup_cpu
, 0, 0 },
1567 { "blockIO", JSON_VARIANT_OBJECT
, oci_cgroup_block_io
, 0, 0 },
1568 { "hugepageLimits", JSON_VARIANT_ARRAY
, oci_unsupported
, 0, 0 },
1569 { "network", JSON_VARIANT_OBJECT
, oci_unsupported
, 0, 0 },
1570 { "pids", JSON_VARIANT_OBJECT
, oci_cgroup_pids
, 0, 0 },
1571 { "rdma", JSON_VARIANT_OBJECT
, oci_unsupported
, 0, 0 },
1575 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
1578 static bool sysctl_key_valid(const char *s
) {
1581 /* Note that we are a bit stricter here than in systemd-sysctl, as that inherited semantics from the old sysctl
1582 * tool, which were really weird (as it swaps / and . in both ways) */
1589 if (*s
<= ' ' || *s
>= 127)
1595 if (dot
) /* Don't allow two dots next to each other (or at the beginning) */
1603 if (dot
) /* don't allow a dot at the end */
1609 static int oci_sysctl(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1610 Settings
*s
= userdata
;
1617 JSON_VARIANT_OBJECT_FOREACH(k
, w
, v
) {
1620 if (!json_variant_is_string(w
))
1621 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1622 "sysctl parameter is not a string, refusing.");
1624 assert_se(m
= json_variant_string(w
));
1626 if (sysctl_key_valid(k
))
1627 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1628 "sysctl key invalid, refusing: %s", k
);
1630 r
= strv_extend_strv(&s
->sysctl
, STRV_MAKE(k
, m
), false);
1639 static int oci_seccomp_action_from_string(const char *name
, uint32_t *ret
) {
1641 static const struct {
1645 { "SCMP_ACT_ALLOW", SCMP_ACT_ALLOW
},
1646 { "SCMP_ACT_ERRNO", SCMP_ACT_ERRNO(EPERM
) }, /* the OCI spec doesn't document the error, but it appears EPERM is supposed to be used */
1647 { "SCMP_ACT_KILL", SCMP_ACT_KILL
},
1648 #ifdef SCMP_ACT_KILL_PROCESS
1649 { "SCMP_ACT_KILL_PROCESS", SCMP_ACT_KILL_PROCESS
},
1651 #ifdef SCMP_ACT_KILL_THREAD
1652 { "SCMP_ACT_KILL_THREAD", SCMP_ACT_KILL_THREAD
},
1655 { "SCMP_ACT_LOG", SCMP_ACT_LOG
},
1657 { "SCMP_ACT_TRAP", SCMP_ACT_TRAP
},
1659 /* We don't support SCMP_ACT_TRACE because that requires a tracer, and that doesn't really make sense
1665 for (i
= 0; i
< ELEMENTSOF(table
); i
++)
1666 if (streq_ptr(name
, table
[i
].name
)) {
1667 *ret
= table
[i
].action
;
1674 static int oci_seccomp_arch_from_string(const char *name
, uint32_t *ret
) {
1676 static const struct {
1680 { "SCMP_ARCH_AARCH64", SCMP_ARCH_AARCH64
},
1681 { "SCMP_ARCH_ARM", SCMP_ARCH_ARM
},
1682 { "SCMP_ARCH_MIPS", SCMP_ARCH_MIPS
},
1683 { "SCMP_ARCH_MIPS64", SCMP_ARCH_MIPS64
},
1684 { "SCMP_ARCH_MIPS64N32", SCMP_ARCH_MIPS64N32
},
1685 { "SCMP_ARCH_MIPSEL", SCMP_ARCH_MIPSEL
},
1686 { "SCMP_ARCH_MIPSEL64", SCMP_ARCH_MIPSEL64
},
1687 { "SCMP_ARCH_MIPSEL64N32", SCMP_ARCH_MIPSEL64N32
},
1688 { "SCMP_ARCH_NATIVE", SCMP_ARCH_NATIVE
},
1689 #ifdef SCMP_ARCH_PARISC
1690 { "SCMP_ARCH_PARISC", SCMP_ARCH_PARISC
},
1692 #ifdef SCMP_ARCH_PARISC64
1693 { "SCMP_ARCH_PARISC64", SCMP_ARCH_PARISC64
},
1695 { "SCMP_ARCH_PPC", SCMP_ARCH_PPC
},
1696 { "SCMP_ARCH_PPC64", SCMP_ARCH_PPC64
},
1697 { "SCMP_ARCH_PPC64LE", SCMP_ARCH_PPC64LE
},
1698 #ifdef SCMP_ARCH_RISCV64
1699 { "SCMP_ARCH_RISCV64", SCMP_ARCH_RISCV64
},
1701 { "SCMP_ARCH_S390", SCMP_ARCH_S390
},
1702 { "SCMP_ARCH_S390X", SCMP_ARCH_S390X
},
1703 { "SCMP_ARCH_X32", SCMP_ARCH_X32
},
1704 { "SCMP_ARCH_X86", SCMP_ARCH_X86
},
1705 { "SCMP_ARCH_X86_64", SCMP_ARCH_X86_64
},
1710 for (i
= 0; i
< ELEMENTSOF(table
); i
++)
1711 if (streq_ptr(table
[i
].name
, name
)) {
1712 *ret
= table
[i
].arch
;
1719 static int oci_seccomp_compare_from_string(const char *name
, enum scmp_compare
*ret
) {
1721 static const struct {
1723 enum scmp_compare op
;
1725 { "SCMP_CMP_NE", SCMP_CMP_NE
},
1726 { "SCMP_CMP_LT", SCMP_CMP_LT
},
1727 { "SCMP_CMP_LE", SCMP_CMP_LE
},
1728 { "SCMP_CMP_EQ", SCMP_CMP_EQ
},
1729 { "SCMP_CMP_GE", SCMP_CMP_GE
},
1730 { "SCMP_CMP_GT", SCMP_CMP_GT
},
1731 { "SCMP_CMP_MASKED_EQ", SCMP_CMP_MASKED_EQ
},
1736 for (i
= 0; i
< ELEMENTSOF(table
); i
++)
1737 if (streq_ptr(table
[i
].name
, name
)) {
1745 static int oci_seccomp_archs(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1746 scmp_filter_ctx
*sc
= userdata
;
1752 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1755 if (!json_variant_is_string(e
))
1756 return json_log(e
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1757 "Architecture entry is not a string");
1759 r
= oci_seccomp_arch_from_string(json_variant_string(e
), &a
);
1761 return json_log(e
, flags
, r
, "Unknown architecture: %s", json_variant_string(e
));
1763 r
= seccomp_arch_add(sc
, a
);
1767 return json_log(e
, flags
, r
, "Failed to add architecture to seccomp filter: %m");
1773 struct syscall_rule
{
1776 struct scmp_arg_cmp
*arguments
;
1780 static void syscall_rule_free(struct syscall_rule
*rule
) {
1783 strv_free(rule
->names
);
1784 free(rule
->arguments
);
1787 static int oci_seccomp_action(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1788 uint32_t *action
= userdata
;
1793 r
= oci_seccomp_action_from_string(json_variant_string(v
), action
);
1795 return json_log(v
, flags
, r
, "Unknown system call action '%s': %m", json_variant_string(v
));
1800 static int oci_seccomp_op(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1801 enum scmp_compare
*op
= userdata
;
1806 r
= oci_seccomp_compare_from_string(json_variant_string(v
), op
);
1808 return json_log(v
, flags
, r
, "Unknown seccomp operator '%s': %m", json_variant_string(v
));
1813 static int oci_seccomp_args(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1814 struct syscall_rule
*rule
= userdata
;
1820 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1821 static const struct JsonDispatch table
[] = {
1822 { "index", JSON_VARIANT_UNSIGNED
, json_dispatch_uint32
, offsetof(struct scmp_arg_cmp
, arg
), JSON_MANDATORY
},
1823 { "value", JSON_VARIANT_UNSIGNED
, json_dispatch_uint64
, offsetof(struct scmp_arg_cmp
, datum_a
), JSON_MANDATORY
},
1824 { "valueTwo", JSON_VARIANT_UNSIGNED
, json_dispatch_uint64
, offsetof(struct scmp_arg_cmp
, datum_b
), 0 },
1825 { "op", JSON_VARIANT_STRING
, oci_seccomp_op
, offsetof(struct scmp_arg_cmp
, op
), JSON_MANDATORY
},
1829 struct scmp_arg_cmp
*a
, *p
;
1832 a
= reallocarray(rule
->arguments
, rule
->n_arguments
+ 1, sizeof(struct syscall_rule
));
1836 rule
->arguments
= a
;
1837 p
= rule
->arguments
+ rule
->n_arguments
;
1839 *p
= (struct scmp_arg_cmp
) {
1846 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, p
);
1850 expected
= p
->op
== SCMP_CMP_MASKED_EQ
? 4 : 3;
1852 json_log(e
, flags
|JSON_WARNING
, 0, "Wrong number of system call arguments for JSON data data, ignoring.");
1854 /* Note that we are a bit sloppy here and do not insist that SCMP_CMP_MASKED_EQ gets two datum values,
1855 * and the other only one. That's because buildah for example by default calls things with
1856 * SCMP_CMP_MASKED_EQ but only one argument. We use 0 when the value is not specified. */
1858 rule
->n_arguments
++;
1864 static int oci_seccomp_syscalls(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1865 scmp_filter_ctx
*sc
= userdata
;
1871 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1872 static const JsonDispatch table
[] = {
1873 { "names", JSON_VARIANT_ARRAY
, json_dispatch_strv
, offsetof(struct syscall_rule
, names
), JSON_MANDATORY
},
1874 { "action", JSON_VARIANT_STRING
, oci_seccomp_action
, offsetof(struct syscall_rule
, action
), JSON_MANDATORY
},
1875 { "args", JSON_VARIANT_ARRAY
, oci_seccomp_args
, 0, 0 },
1877 struct syscall_rule rule
= {
1878 .action
= (uint32_t) -1,
1882 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, &rule
);
1886 if (strv_isempty(rule
.names
)) {
1887 json_log(e
, flags
, 0, "System call name list is empty.");
1892 STRV_FOREACH(i
, rule
.names
) {
1895 nr
= seccomp_syscall_resolve_name(*i
);
1896 if (nr
== __NR_SCMP_ERROR
) {
1897 log_debug("Unknown syscall %s, skipping.", *i
);
1901 r
= seccomp_rule_add_array(sc
, rule
.action
, nr
, rule
.n_arguments
, rule
.arguments
);
1906 syscall_rule_free(&rule
);
1910 syscall_rule_free(&rule
);
1918 static int oci_seccomp(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1921 static const JsonDispatch table
[] = {
1922 { "defaultAction", JSON_VARIANT_STRING
, NULL
, 0, JSON_MANDATORY
},
1923 { "architectures", JSON_VARIANT_ARRAY
, oci_seccomp_archs
, 0, 0 },
1924 { "syscalls", JSON_VARIANT_ARRAY
, oci_seccomp_syscalls
, 0, 0 },
1928 _cleanup_(seccomp_releasep
) scmp_filter_ctx sc
= NULL
;
1929 Settings
*s
= userdata
;
1936 def
= json_variant_by_key(v
, "defaultAction");
1938 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
), "defaultAction element missing.");
1940 if (!json_variant_is_string(def
))
1941 return json_log(def
, flags
, SYNTHETIC_ERRNO(EINVAL
), "defaultAction is not a string.");
1943 r
= oci_seccomp_action_from_string(json_variant_string(def
), &d
);
1945 return json_log(def
, flags
, r
, "Unknown default action: %s", json_variant_string(def
));
1947 sc
= seccomp_init(d
);
1949 return json_log(v
, flags
, SYNTHETIC_ERRNO(ENOMEM
), "Couldn't allocate seccomp object.");
1951 r
= json_dispatch(v
, table
, oci_unexpected
, flags
, sc
);
1955 seccomp_release(s
->seccomp
);
1956 s
->seccomp
= TAKE_PTR(sc
);
1959 return json_log(v
, flags
, SYNTHETIC_ERRNO(EOPNOTSUPP
), "libseccomp support not enabled, can't parse seccomp object.");
1963 static int oci_rootfs_propagation(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1966 s
= json_variant_string(v
);
1968 if (streq(s
, "shared"))
1971 json_log(v
, flags
|JSON_DEBUG
, 0, "Ignoring rootfsPropagation setting '%s'.", s
);
1975 static int oci_masked_paths(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
1976 Settings
*s
= userdata
;
1981 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
1982 _cleanup_free_
char *destination
= NULL
;
1986 if (!json_variant_is_string(e
))
1987 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1988 "Path is not a string, refusing.");
1990 assert_se(p
= json_variant_string(e
));
1992 if (!path_is_absolute(p
))
1993 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
1994 "Path is not not absolute, refusing: %s", p
);
1996 if (oci_exclude_mount(p
))
1999 destination
= strdup(p
);
2003 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_INACCESSIBLE
);
2007 m
->destination
= TAKE_PTR(destination
);
2009 /* The spec doesn't say this, but apparently pre-existing implementations are lenient towards
2010 * non-existing paths to mask. Let's hence be too. */
2017 static int oci_readonly_paths(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2018 Settings
*s
= userdata
;
2023 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
2024 _cleanup_free_
char *source
= NULL
, *destination
= NULL
;
2028 if (!json_variant_is_string(e
))
2029 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2030 "Path is not a string, refusing.");
2032 assert_se(p
= json_variant_string(e
));
2034 if (!path_is_absolute(p
))
2035 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2036 "Path is not not absolute, refusing: %s", p
);
2038 if (oci_exclude_mount(p
))
2041 source
= strjoin("+", p
);
2045 destination
= strdup(p
);
2049 m
= custom_mount_add(&s
->custom_mounts
, &s
->n_custom_mounts
, CUSTOM_MOUNT_BIND
);
2053 m
->source
= TAKE_PTR(source
);
2054 m
->destination
= TAKE_PTR(destination
);
2055 m
->read_only
= true;
2061 static int oci_linux(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2063 static const JsonDispatch table
[] = {
2064 { "namespaces", JSON_VARIANT_ARRAY
, oci_namespaces
, 0, 0 },
2065 { "uidMappings", JSON_VARIANT_ARRAY
, oci_uid_gid_mappings
, 0, 0 },
2066 { "gidMappings", JSON_VARIANT_ARRAY
, oci_uid_gid_mappings
, 0, 0 },
2067 { "devices", JSON_VARIANT_ARRAY
, oci_devices
, 0, 0 },
2068 { "cgroupsPath", JSON_VARIANT_STRING
, oci_cgroups_path
, 0, 0 },
2069 { "resources", JSON_VARIANT_OBJECT
, oci_resources
, 0, 0 },
2070 { "intelRdt", JSON_VARIANT_OBJECT
, oci_unsupported
, 0, JSON_PERMISSIVE
},
2071 { "sysctl", JSON_VARIANT_OBJECT
, oci_sysctl
, 0, 0 },
2072 { "seccomp", JSON_VARIANT_OBJECT
, oci_seccomp
, 0, 0 },
2073 { "rootfsPropagation", JSON_VARIANT_STRING
, oci_rootfs_propagation
, 0, 0 },
2074 { "maskedPaths", JSON_VARIANT_ARRAY
, oci_masked_paths
, 0, 0 },
2075 { "readonlyPaths", JSON_VARIANT_ARRAY
, oci_readonly_paths
, 0, 0 },
2076 { "mountLabel", JSON_VARIANT_STRING
, oci_unsupported
, 0, JSON_PERMISSIVE
},
2080 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
2083 static int oci_hook_timeout(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2084 usec_t
*u
= userdata
;
2087 k
= json_variant_unsigned(v
);
2088 if (k
== 0 || k
> (UINT64_MAX
-1)/USEC_PER_SEC
)
2089 return json_log(v
, flags
, SYNTHETIC_ERRNO(ERANGE
),
2090 "Hook timeout value out of range.");
2092 *u
= k
* USEC_PER_SEC
;
2096 static int oci_hooks_array(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2097 Settings
*s
= userdata
;
2103 JSON_VARIANT_ARRAY_FOREACH(e
, v
) {
2105 static const JsonDispatch table
[] = {
2106 { "path", JSON_VARIANT_STRING
, oci_absolute_path
, offsetof(OciHook
, path
), JSON_MANDATORY
},
2107 { "args", JSON_VARIANT_ARRAY
, oci_args
, offsetof(OciHook
, args
), 0 },
2108 { "env", JSON_VARIANT_ARRAY
, oci_env
, offsetof(OciHook
, env
), 0 },
2109 { "timeout", JSON_VARIANT_UNSIGNED
, oci_hook_timeout
, offsetof(OciHook
, timeout
), 0 },
2113 OciHook
*a
, **array
, *new_item
;
2116 if (streq(name
, "prestart")) {
2117 array
= &s
->oci_hooks_prestart
;
2118 n_array
= &s
->n_oci_hooks_prestart
;
2119 } else if (streq(name
, "poststart")) {
2120 array
= &s
->oci_hooks_poststart
;
2121 n_array
= &s
->n_oci_hooks_poststart
;
2123 assert(streq(name
, "poststop"));
2124 array
= &s
->oci_hooks_poststop
;
2125 n_array
= &s
->n_oci_hooks_poststop
;
2128 a
= reallocarray(*array
, *n_array
+ 1, sizeof(OciHook
));
2133 new_item
= a
+ *n_array
;
2135 *new_item
= (OciHook
) {
2136 .timeout
= USEC_INFINITY
,
2139 r
= json_dispatch(e
, table
, oci_unexpected
, flags
, userdata
);
2141 free(new_item
->path
);
2142 strv_free(new_item
->args
);
2143 strv_free(new_item
->env
);
2153 static int oci_hooks(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2155 static const JsonDispatch table
[] = {
2156 { "prestart", JSON_VARIANT_OBJECT
, oci_hooks_array
, 0, 0 },
2157 { "poststart", JSON_VARIANT_OBJECT
, oci_hooks_array
, 0, 0 },
2158 { "poststop", JSON_VARIANT_OBJECT
, oci_hooks_array
, 0, 0 },
2162 return json_dispatch(v
, table
, oci_unexpected
, flags
, userdata
);
2165 static int oci_annotations(const char *name
, JsonVariant
*v
, JsonDispatchFlags flags
, void *userdata
) {
2169 JSON_VARIANT_OBJECT_FOREACH(k
, w
, v
) {
2172 return json_log(v
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2173 "Annotation with empty key, refusing.");
2175 if (!json_variant_is_string(w
))
2176 return json_log(w
, flags
, SYNTHETIC_ERRNO(EINVAL
),
2177 "Annotation has non-string value, refusing.");
2179 json_log(w
, flags
|JSON_DEBUG
, 0, "Ignoring annotation '%s' with value '%s'.", k
, json_variant_string(w
));
2185 int oci_load(FILE *f
, const char *bundle
, Settings
**ret
) {
2187 static const JsonDispatch table
[] = {
2188 { "ociVersion", JSON_VARIANT_STRING
, NULL
, 0, JSON_MANDATORY
},
2189 { "process", JSON_VARIANT_OBJECT
, oci_process
, 0, 0 },
2190 { "root", JSON_VARIANT_OBJECT
, oci_root
, 0, 0 },
2191 { "hostname", JSON_VARIANT_STRING
, oci_hostname
, 0, 0 },
2192 { "mounts", JSON_VARIANT_ARRAY
, oci_mounts
, 0, 0 },
2193 { "linux", JSON_VARIANT_OBJECT
, oci_linux
, 0, 0 },
2194 { "hooks", JSON_VARIANT_OBJECT
, oci_hooks
, 0, 0 },
2195 { "annotations", JSON_VARIANT_OBJECT
, oci_annotations
, 0, 0 },
2199 _cleanup_(json_variant_unrefp
) JsonVariant
*oci
= NULL
;
2200 _cleanup_(settings_freep
) Settings
*s
= NULL
;
2201 unsigned line
= 0, column
= 0;
2208 path
= strjoina(bundle
, "/config.json");
2210 r
= json_parse_file(f
, path
, 0, &oci
, &line
, &column
);
2212 if (line
!= 0 && column
!= 0)
2213 return log_error_errno(r
, "Failed to parse '%s' at %u:%u: %m", path
, line
, column
);
2215 return log_error_errno(r
, "Failed to parse '%s': %m", path
);
2218 v
= json_variant_by_key(oci
, "ociVersion");
2220 log_error("JSON file '%s' is not an OCI bundle configuration file. Refusing.", path
);
2223 if (!streq_ptr(json_variant_string(v
), "1.0.0")) {
2224 log_error("OCI bundle version not supported: %s", strna(json_variant_string(v
)));
2229 // _cleanup_free_ char *formatted = NULL;
2230 // assert_se(json_variant_format(oci, JSON_FORMAT_PRETTY|JSON_FORMAT_COLOR, &formatted) >= 0);
2231 // fputs(formatted, stdout);
2238 s
->start_mode
= START_PID1
;
2239 s
->resolv_conf
= RESOLV_CONF_OFF
;
2240 s
->link_journal
= LINK_NO
;
2241 s
->timezone
= TIMEZONE_OFF
;
2243 s
->bundle
= strdup(bundle
);
2247 r
= json_dispatch(oci
, table
, oci_unexpected
, 0, s
);
2251 if (s
->properties
) {
2252 r
= sd_bus_message_seal(s
->properties
, 0, 0);
2254 return log_error_errno(r
, "Cannot seal properties bus message: %m");